what is darkforums-ip-intel fr?

ivancastl/darkforums-ip-intel — explained in plain English

Analysis updated 2026-05-18

★ 20PythonAudience · ops devopsComplexity · 2/5LicenseSetup · easy

vibe map

mindmap
  root((darkforums-ip-intel))
    What it does
      Visualize threat actor IPs
      Interactive browser map
      Actor username search
      Country filter
    Data sources
      GeoLite2 offline database
      ipinfo.io API enrichment
      DarkForums IP dataset
    Tech Stack
      Python
      Flask
      Leaflet.js
      GeoLite2
    Use cases
      Threat intelligence research
      Cybercrime investigation
      IP attribution analysis

mindmap root((darkforums-ip-intel)) What it does Visualize threat actor IPs Interactive browser map Actor username search Country filter Data sources GeoLite2 offline database ipinfo.io API enrichment DarkForums IP dataset Tech Stack Python Flask Leaflet.js GeoLite2 Use cases Threat intelligence research Cybercrime investigation IP attribution analysis

what do people make with this?

VIBE 1

Map IP addresses linked to specific DarkForums threat actors to see their geographic distribution at a glance

VIBE 2

Search by username to filter the map to one actor's known IP addresses during an investigation

VIBE 3

Run offline geolocation without any API key using the bundled GeoLite2 database

VIBE 4

Enrich a selected IP with city, ISP, timezone, and hostname details via the ipinfo.io free tier

what's the stack?

PythonFlaskLeaflet.jsGeoLite2ipinfo.io

how it stacks up fr

	ivancastl/darkforums-ip-intel	alex72-py/aria-termux	anime0t4ku/gentleman
Stars	20	20	20
Language	Python	Python	Python
Setup difficulty	easy	moderate	moderate
Complexity	2/5	2/5	2/5
Audience	ops devops	developer	general

Figures from each repo's GitHub metadata at analysis time.

how do i run it?

Difficulty · easy time til it works · 5min

Clone, install Python dependencies, and optionally add an ipinfo.io token, works offline without the token using GeoLite2.

MIT license, use freely for any purpose, including commercial, as long as you keep the copyright notice.

in plain english

This project is an open-source intelligence tool for visualizing IP addresses associated with DarkForums, a cybercrime forum. The README is written in Spanish. The tool takes a database of IP addresses linked to specific threat actors from that forum and plots them on an interactive dark-themed map in a web browser. Geolocation is handled offline using the GeoLite2 database, which maps IP addresses to countries and approximate locations without requiring any internet connection. When you click on a pin on the map, the tool calls the ipinfo.io API to enrich the result with more precise details: city, internet service provider, timezone, and hostname. The ipinfo.io free tier allows 50,000 lookups per month, and the map continues working without a token using GeoLite2 alone. The interface includes username search with autocomplete, so you can type part of a name and jump to that actor's IP addresses. Clicking a suggestion filters the map to show only that actor's pins. There is also a country filter and a small inset map in the side panel that shows the exact location of whichever pin you selected. Duplicate IPs per actor are removed automatically. To run it, you clone the repository, install the Python dependencies, optionally enter an ipinfo.io token when prompted, and open a local web address in your browser. The backend is a Flask web server and the map is rendered with Leaflet.js. The project is released under the MIT license. The data in the repository covers IP addresses attributed to DarkForums activity. This is intended as a threat intelligence reference for security researchers.

prompts (copy fr)

prompt 1

I cloned darkforums-ip-intel and installed the dependencies. Walk me through running the Flask server and loading the IP map in my browser, with and without an ipinfo.io token.

prompt 2

How does darkforums-ip-intel use GeoLite2 to geolocate IPs offline? Show me the Python code pattern it uses to look up a country and coordinates from an IP address.

prompt 3

I want to add my own IP dataset to darkforums-ip-intel. What format does the IP database need to be in, and where do I add it so the map picks it up?

prompt 4

Explain how the username autocomplete search in darkforums-ip-intel filters the Leaflet.js map markers to show only one actor's pins.

prompt 5

I hit the 50,000/month ipinfo.io free-tier limit. How do I configure darkforums-ip-intel to fall back to GeoLite2-only mode for all lookups?

Frequently asked questions